Publications associées à Improving systems software security through program analysis and instrumentation

Secure Interface Design Leveraging Hardware/Software Support

Computer systems rely heavily on abstraction to manage the exponential growth of complexity across hardware and software. Due to practical considerations of compatibility between components of these complex systems across generations, developers have favou ...

EPFL2024

X-Attack 2.0: The Risk of Power Wasters and Satisfiability Don’t-Care Hardware Trojans to Shared Cloud FPGAs

Mirjana Stojilovic, Wei Hu, Dina Gamaleldin Ahmed Shawky Mahmoud, Beatrice Shokry Samir Shokry

Cloud computing environments increasingly provision field-programmable gate arrays (FPGAs) for their programmability and hardware-level parallelism. While FPGAs are typically used by one tenant at a time, multitenant schemes supporting spatial sharing of c ...

2024

Design and in vitro Characterization of a Wearable Multisensing System for Hydration Monitoring

Sandro Carrara, Sarah Tonello, Ata Jedari Golparvar, Ali Meimandi

Dehydration is a frequent condition in the elderly and can lead to serious health complications if not compensated timely. Early diagnosis can be problematic, as medical examinations in the hospital would be needed. Fully wearable low-cost multisensing dev ...

Ieee-Inst Electrical Electronics Engineers Inc2024

Formal Foundations of Capture Tracking

Aleksander Slawomir Boruch-Gruszecki

Type systems are a device for verifying properties of programs without running them. Many programming languages used in the industry have always had a type system, while others were initially created without a type system and later adopted one, when the ad ...

EPFL2024

ACTOR: Action-Guided Kernel Fuzzing

Mathias Josef Payer

Fuzzing reliably and efficiently finds bugs in software, including operating system kernels. In general, higher code coverage leads to the discovery of more bugs. This is why most existing kernel fuzzers adopt strategies to generate a series of inputs that ...

Usenix Assoc2023

A RISC-V Extension to Minimize Privileges of Enclave Runtimes

Edouard Bugnion, Neelu Shivprakash Kalani

In confidential computing, the view of the system software is Manichean: the host operating system is untrusted and the TEE runtime system is fully trusted. However, the runtime system is often as complex as a full operating system, and thus is not free fr ...

ACM2023

Dynamic Linkers Are the Narrow Waist of Operating Systems

Adrien Ghosn, Charly Nicolas Lucien Castes

While software applications, programming languages, and hardware have changed, operating systems have not. Widely-used commodity operating systems are still modeled after the ones designed in the seventies. The accumulated burden of backward compatibility ...

Association for Computing Machinery2023

Arvin: Greybox Fuzzing Using Approximate Dynamic CFG Analysis

Sirus Shahini, Mathias Josef Payer

Fuzzing has emerged as the most broadly used testing technique to discover bugs. Effective fuzzers rely on coverage to prioritize inputs that exercise new program areas. Edge-based code coverage of the Program Under Test (PUT) is the most commonly used cov ...

ASSOC COMPUTING MACHINERY2023

Silent Bugs Matter: A Study of Compiler-Introduced Security Bugs

Mathias Josef Payer, Jianhao Xu

Compilers assure that any produced optimized code is semantically equivalent to the original code. However, even "correct" compilers may introduce security bugs as security properties go beyond translation correctness. Security bugs introduced by such corr ...

Usenix Assoc2023

A review of the security vulnerabilities and countermeasures in the Internet of Things solutions: A bright future for the Blockchain

Jan Van Herle, Hossein Pourrahmani

The current advances in the Internet of Things (IoT) and the solutions being offered by this technology have accounted IoT among the top ten technologies that will transform the global economy by 2030. IoT is a state-of-the-art paradigm that has developed ...

2023

Rebooting Virtual Memory with Midgard

Siddharth Gupta

Virtual Memory (VM) is a critical programming abstraction that is widely used in various modern computing platforms. With the rise of datacenter computing and birth of planet-scale online services, the semantic and capacity requirements from memory have ev ...

EPFL2023

GLeeFuzz: FuzzingWebGL Through Error Message Guided Mutation

Hui Peng, Mathias Josef Payer

WebGL is a set of standardized JavaScript APIs for GPU accelerated graphics. Security of the WebGL interface is paramount because it exposes remote and unsandboxed access to the underlying graphics stack (including the native GL libraries and GPU drivers) ...

Usenix Assoc2023

Exploring brain-inspired multi-core heterogeneous hardware templates for low-power biomedical embedded systems

Benoît Walter Denkinger

The miniaturization of integrated circuits (ICs) and their higher performance and energy efficiency, combined with new machine learning algorithms and applications, have paved the way to intelligent, interconnected edge devices. In the medical domain, they ...

EPFL2023

Anonymous Tokens with Stronger Metadata Bit Hiding from Algebraic MACs

Serge Vaudenay, Fatma Betül Durak

On the one hand, the web needs to be secured from malicious activities such as bots or DoS attacks; on the other hand, such needs ideally should not justify services tracking people's activities on the web. Anonymous tokens provide a nice tradeoff between ...

2023

Object-oriented modelling of advanced computer cooling solutions

David Atienza Alonso, Federico Terraneo

Modern computing systems are so energy- intensive to make efficient cooling vital for their operation. This is giving rise to a variety of innovative cooling solutions based on a mix of traditional and new techniques. The design and engineering of these so ...

Elsevier2023

One Fuzz Doesn’t Fit All: Optimizing Directed Fuzzing via Target-tailored Program State Restriction

Mathias Josef Payer

Fuzzing is the de-facto default technique to discover software flaws, randomly testing programs to discover crashing test cases. Yet, a particular scenario may only care about specific code regions (for, e.g., bug reproduction, patch or regression testing) ...

ASSOC COMPUTING MACHINERY2022

Midas: Systematic Kernel TOCTTOU Protection

Atri Bhattacharyya, Uros Tesic, Mathias Josef Payer

Double-fetch bugs are a plague across all major operating system kernels. They occur when data is fetched twice across the user/kernel trust boundary while allowing concurrent modification. Such bugs enable an attacker to illegally access memory, cause den ...

2022

AstriFlash: A Flash-Based System for Online Services

Babak Falsafi, Mark Johnathon Sutherland, Siddharth Gupta, Lei Yan, Yunho Oh

Modern datacenters host datasets in DRAM to offer large-scale online services with tight tail-latency requirements. Unfortunately, as DRAM is expensive and increasingly difficult to scale, datacenter operators are forced to consider denser storage technolo ...

2023

Scaling Language Features for Program Verification

Georg Stefan Schmid

Formal verification of real-world software systems remains challenging for a number of reasons, including lack of automation, friction in specifying properties, and limited support for the diverse programming paradigms used in industry. In this thesis we m ...

EPFL2022

Preventing Use-After-Free Attacks with Fast Forward Allocation

Jungwon Lim, Sanidhya Kashyap

Memory-unsafe languages are widely used to implement critical systems like kernels and browsers, leading to thousands of memory safety issues every year. A use-after-free bug is a temporal memory error where the program accidentally visits a freed memory l ...

USENIX ASSOC2021